From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-qk1-f175.google.com (mail-qk1-f175.google.com [209.85.222.175]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 4400C3B71BA for ; Thu, 6 Aug 2026 14:43:15 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.222.175 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786027396; cv=none; b=ersKHT/7dbopXZbHQLC8Y9stRbuotdMGAgwpkNEIErqzxockgMe/yugxzRIrMEGKhP4ASPHPdia8a+8lhss36oE9sf6tQzWiI+oy5n5xbynPAhS1o/2jXDVhOK+DDVqTNvUoHl9heLX669alU3AUtLTU2ogFjtVctMqHWBwHcJk= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786027396; c=relaxed/simple; bh=QXyumIIVVZEJjd14fJDOG6kk/TauhmZNZgQBcQSuUAg=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=UGkiC720o9eH6VwYkKggQzKMrglkdvEWGSH75yDN+b9HVvpQeeAd0Mrp39DkfI/rhJOt43zoiqzTv0ELTzqK+NkOcziqT8AUB/FXMpjJEb4yzaJp5WRVxQj1Icu0LDomeo/nTk7tpv5pH4nNX/W8qiV6DFo/jrMFF489EfGd7kU= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=mos+IApL; arc=none smtp.client-ip=209.85.222.175 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="mos+IApL" Received: by mail-qk1-f175.google.com with SMTP id af79cd13be357-92e6c4a867cso153289985a.0 for ; Thu, 06 Aug 2026 07:43:15 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1786027394; x=1786632194; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=mQCss4lFgE6Dwf1NizCh8ZHT2e94D2G9yvtYGo+Xll0=; b=mos+IApLee1IYoxyOW2it7UUx3EgZl2W7aPAdI2t/BhhLhgt+xJlp3U66SyCcGjdt0 gLjsd0GfDhDikPTMboRjHgsdafc9VE9f/FjKvVTtVmGnvjmksCZ0GIKLmIEvL3xyE9TZ 5rvtGztbiB+IW1zKLuVpSl/+a8RfdSN6PCXA3ZPbhOsQiVUTzG2XVQpZTkLEvxQM/J9w g1xNJ0SPTp+RkYBP9DFkXE4I0Kx/w/1Ifv0z6n4Y63SgoMKyYMQnFXf2Ug0GZbyBJntg H4VruX3I/PdPo7ncIJt3j+pQXDY0ucd0prNAR98SRaqVvrkM4e8VxGTrmll85y6cuKU1 +Puw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1786027394; x=1786632194; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=mQCss4lFgE6Dwf1NizCh8ZHT2e94D2G9yvtYGo+Xll0=; b=UrerUVRoOLojU7BU5aZgrRo5ZKfLX2oO/1NOrA7us5jBDTMu3dcIIyDd3OrdpIcsu8 jlUH1ZSxqgoFxyvRri1py5l1/ngpYHG1oDr0SUoNm9APYhb11HSKBZ4KmFrRW/L6Nyf1 +8f2EfPEs9HB0aSMgm2tCLYVqkvSVeLeavHWTiHzW4yWXHfAtC/srrPlSXzL1k95Gsi6 HwUQ7QVuozNuKYmQxb1/OAXPhOLgG71tGSBLTu/9y2/syen3xsUj3pY9aYDqShB1UsY4 qmzJzFcuMoOCHx5Bhq6QXKdSHDXzEySqZAsFKkJnvRNCMM+RBUuMw4UQAdh53ST0N/mT oloA== X-Forwarded-Encrypted: i=1; AHgh+RohIyjtElZ2t/PDBEEtfJZu7kq8Hyk4IccLhENDkQxFF7DgjB3Bm+G8VLlSjkou8Al4BrxTrxZpOcQSkEk=@vger.kernel.org X-Gm-Message-State: AOJu0Yz1BudSq2cWvCSHOLNW3xAsCk+r68o3FdU7whSAuIa3VEIxybAn S1V/quBJP1UL/cK4vRFcSb4nWECkhcjbUwrn3e1s4jsRwpfW36dDpdg2 X-Gm-Gg: AR+sD125axY3BAHMsoEEcbcmwdAJgKHUF+nypTnHDnh6LLIhxm1QK6ZQzQRurrwg7Ja 3s8CzxiRae9B17szeaJnFwBNW6MHY/g9oXfVZiMGggfa3CXlFQtNizSDhoES1lOAUPjBV9YQyOs rMEDB8jTKWM7BqbP6srBAl0IqFTG/fouP+B5MAKRTBGi9yEzSpr03OKLSklQ0duTLl5yfq4FJ7T GiADdG0cwCUj8NXYI4Cv5Q+4mppTCfgwNRF8Palv48Ew3QJK15oKOHfdca6zZw6EiN9b3fY2I7T it0cXWoKV7UAhwNfD1hCO3F0wvn6Lvvc1b3O7t3h051DsvlBnO9XX+n65jOHyoBgACbmYTduJuk PLx765diQBS9VGNK1o1/LpqGs5SxsvM9UCvr3xuciVd5zVprzCJO3RWyYIEOTtT/ZuHR0U+dtjF ZHbelEH3s0MIM3n06XIO+d63jji4DNiJo/SpDF14wZ4nN1rIX8evLJsUNbjat64DtPJcjs1M+Kx l2tNHMr1bW0MtdIX3gDR7W7DdzNIfVxncJ8P31hRbs= X-Received: by 2002:ac8:5e08:0:b0:527:f0a:ccbc with SMTP id d75a77b69052e-52ce5fa28acmr159831981cf.18.1786027393869; Thu, 06 Aug 2026 07:43:13 -0700 (PDT) Received: from LAPTOP-DPAKMOI4.it.purdue.edu (pal-210-106-74.itap.purdue.edu. [128.210.106.74]) by smtp.gmail.com with ESMTPSA id 6a1803df08f44-9088a219ea8sm35070376d6.37.2026.08.06.07.43.12 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 06 Aug 2026 07:43:13 -0700 (PDT) From: Yifei Gao To: Eric Van Hensbergen , Latchesar Ionkov , Dominique Martinet , v9fs@lists.linux.dev Cc: Christian Schoenebeck , Juergen Gross , Boris Ostrovsky , Stefano Stabellini , xen-devel@lists.xenproject.org, linux-kernel@vger.kernel.org, stable@vger.kernel.org, Yifei Gao Subject: [PATCH v2] 9p/xen: fix refcount leak in p9_xen_response() on wrong tag Date: Thu, 6 Aug 2026 14:42:54 +0000 Message-ID: <20260806144255.4167019-1-gyf161023@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260804213550.3409638-1-gyf161023@gmail.com> References: <20260804213550.3409638-1-gyf161023@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit p9_xen_response() looks up the request for an incoming reply with p9_tag_lookup(), which takes a reference on the returned p9_req_t. When the tag does not resolve to a request in REQ_STATUS_SENT, the function warns and continues the loop without dropping that reference, permanently leaking the p9_req_t and its msize buffers. The reply header, including the tag, is supplied by the backend, so a malicious or buggy 9P backend can leak kernel memory on every crafted response. Drop the reference before continuing. Fixes: 728356dedeff ("9p: Add refcount to p9_req_t") Cc: stable@vger.kernel.org Assisted-by: Claude:claude-opus-4-8 Signed-off-by: Yifei Gao Reviewed-by: Stefano Stabellini --- v2: - Fix Fixes: tag to reference the correct commit (728356dedeff). - Drop the inaccurate trans_fd.c comparison from the changelog. - Add Reviewed-by from Stefano. net/9p/trans_xen.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/net/9p/trans_xen.c b/net/9p/trans_xen.c index f9fb2db7a066..8eea0da8797f 100644 --- a/net/9p/trans_xen.c +++ b/net/9p/trans_xen.c @@ -203,6 +203,8 @@ static void p9_xen_response(struct work_struct *work) req = p9_tag_lookup(priv->client, h.tag); if (!req || req->status != REQ_STATUS_SENT) { dev_warn(&priv->dev->dev, "Wrong req tag=%x\n", h.tag); + if (req) + p9_req_put(priv->client, req); cons += h.size; virt_mb(); ring->intf->in_cons = cons; -- 2.43.0